What the Concierge Records

The Concierge keeps a turn log, and the log stores what each turn was about — not what you said.

What is stored

For every turn: a category (codes, connections, invitations, help, and so on), which action ran, how it ended, which key wrote the answer (your own, the Trusted Codes key, or none), the language, and the cost of the model call. Your sentence and the Concierge’s reply are not stored. Codes the Concierge shows you never reach the model at all.

A turn your device answered by itself — the keyless help, a verify the app resolved locally — is counted the same way, with nothing of the sentence sent.

The 30-day hold

When the model classifies a turn as abuse — reading other people’s data, enumerating accounts, overriding the Concierge’s instructions, fraud, harassment or illegal content — the sentence and the reply are kept encrypted for 30 days. Only a Trusted Codes super administrator (on a self-hosted server, an operator holding the reveal right) can open a held turn, one at a time, and every opening is written to a record that is never deleted. After 30 days the text is deleted. If nobody opened it, the abuse tag is removed too: an unreviewed judgment does not outlive the text that could check it.

Deleting your account

Deleting your account deletes your turn log. A turn under the 30-day hold is the one exception: it stays, with no link to you, until its 30 days end (GDPR Art. 17(3)(e)). Your data export includes your turn log, and — for a held turn — its text, because it is yours.